├── fairfree.py
├── LICENSE
├── README.md
└── fairfree.js


/fairfree.py:
--------------------------------------------------------------------------------
 1 | import frida
 2 | import sys
 3 | 
 4 | jscode = """
 5 | 
 6 | """
 7 | 
 8 | with open('fairfree.js') as f:
 9 |     jscode = f.read()
10 | 
11 | def printMessage(message,data):
12 |     if message['type'] == 'send':
13 |         print(' {0}'.format(message['payload']))
14 |     else:
15 |         print(message)
16 | 
17 | process = frida.get_usb_device().attach('fairplayd.H2')
18 | script = process.create_script(jscode)
19 | script.on('message',printMessage)
20 | script.load()
21 | sys.stdin.read()
22 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2023 RootHide
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # FairFree
 2 | 
 3 | jailbreak any ipa and run on apple silicon M1/M2 macOS without decrypted.
 4 | 
 5 | 
 6 | ## Initial thought
 7 | 
 8 | when Apple released an ARM-based Mac and announced that it could allow iOS apps, everyone was excited. but soon after, apple prevented users from installing IPA at will through macos updates. and only a small number of iOS apps are available on macos appstore.
 9 | 
10 | so everyone began to look for other methods, such as decrypting all mach-o in the ipa and repackaging it in jailbroken iOS. however, this method has many limitations, such as some apps prevent you from decrypting, and some apps will detect whether they are decrypted when running, even checks whether its own signature is the stock version.
11 | 
12 | and running decrypted ipa in macos usually requires disabling SIP and re-signing the ipa with a valid certificate, which undoubtedly adds a lot of trouble. many people also use PlayCover to run decrypted apps without re-signing the ipa, but it is convert ios app to catalysts app, some apps may not run properly.
13 | 
14 | <img width="699" alt="image" src="https://github.com/RootHide/FairFree/assets/134120506/f6c1887d-790e-4f76-8773-decfbd2d783e">
15 | 
16 | ## Investigate
17 | 
18 | we started thinking about the way apple implements this restriction. is it in the code of the macOS system itself or in the ipa package? after some investigation we came to the following facts:
19 | 
20 | 1: the originally released macos11.0 system can still install any ipa without restrictions.
21 | 
22 | 2: some ipa downloaded in macos 11.0 can still be installed in the new macos, even if the latest version of ipa is restricted.
23 | 
24 | so the conclusion is that apple implemented the flags and restrictions in both the new version of macos and the new version of ipa.
25 | 
26 | ## Start journey
27 | 
28 | since we didn't have a device on hand that could run macos11.0, we first started analyzing the restrictions and flags in the ipa. after some testing and analysis, we quickly found some useful clues, the installation log showed that the restriction flags in the ipa seemed From the SINF file:
29 | ```
30 | 19:25:24.665931+0800	appinstalld	0x16d5c3000 -[MIExecutableBundle validateSinfWithError:]: 1487: 
31 | The SINF provided for the bundle at /private/var/containers/Temp/Bundle/Application/8EC2AA9C-9688-49E0-B9B8-C4E4FE3DD987/maps.app is not valid on this platform.
32 | ```
33 | 
34 | it is easy to see some interesting things when looking at the SC_Info/*.sinf file: "mode". we compared the two ipas and found that their modes are indeed different. 
35 | 
36 | <img width="1561" alt="image" src="https://github.com/RootHide/FairFree/assets/134120506/45e9b23f-542d-4dd6-bc2f-81ceea4fb471">
37 | 
38 | 
39 | we tried to modify the mode value, but when installing, it prompted that the ipa was damaged. then we replaced the sinf file of one ipa with another ipa and found that the restricted ipa could indeed be installed, but it could not be run, we guessed that the sinf file contained some key information of mach-o in for the runtime decryption.
40 | ```
41 | 
19:35:14.863265+0800	kernel	proc 53276: set_code_unprotect() error 7 for file "maps"
42 | ```
43 | 
44 | the only feasible way is to find the correct way to modify the mode value. after some testing and analysis, we found that the second half of the sinf file seems to contain a piece of encrypted data called priv.
45 | 
46 | <img width="565" alt="image" src="https://github.com/RootHide/FairFree/assets/134120506/a7100f3a-5e6d-47dd-853c-aa8357cc74c6">
47 | 
48 | 
49 | ## Into the hell
50 | 
51 | after further analysis and testing, we finally found the protagonist: FairPlay
52 | 
53 | there is very little information about FairPlay on the Internet. we can only know that it is a system used by apple to protect ipa from unauthorized installation and use. it includes the user-mode fairplayd daemon and the kernel iokit extension.
54 | 
55 | when we started analyzing the fairplayd binary, we realized that it was an ollvm hell, all functions and instructions highly obfuscated, no any symbolic information, no logs, even no any useful strings. fortunately we were donated an advanced tool to analyze obfuscated code. 
56 | 
57 | ![image](https://github.com/RootHide/FairFree/assets/134120506/93a15761-f29d-4a25-adb2-552830dc2793)
58 | 
59 | ![image](https://github.com/RootHide/FairFree/assets/134120506/b888d78c-5d07-4acb-87fb-68f965640ef8)
60 | 
61 | 
62 | ## Death and reborn
63 | 
64 | after a whole month of analysis and debugging, we finally successfully decrypted the priv field and could freely modify the sinf file. 
65 | 
66 | <img width="1607" alt="image" src="https://github.com/RootHide/FairFree/assets/134120506/32f7b76d-afe4-486f-b18d-0822ce7873cb">
67 | 
68 | the priv field is almost the encrypted backup of the first half of sinf. so we only have to modify the plaintext mode and the encrypted mode at the same time to install and run any iOS app on macos without restrictions.
69 | 
70 | the decryption function seemed to be a variant of AES128, with all cryptographic loops fully expanded, and had almost 8000 local variables after obfuscated. so we wrote a script to hack it on specific device and ios version.
71 | 
72 | ## Enjoy it
73 | 
74 | how to use:
75 | 
76 | 1. device iphone X & ios13.5.1
77 | 2. jailbreak & install frida-server
78 | 3. login apple id in appstore & install the app
79 | 4. ```chmod -R 777 /path/to/*.app/SC_Info/``` on ios
80 | 5. run ```python3 fairfree.py``` on computer
81 | 6. launch the app in home screen
82 | 7. check the "mode" in SC_Info/*.sinf
83 | 8. zip the *.app to a ipa file
84 | 9. copy ipa file to macos and install
85 | 10. login the apple id in macos appstore
86 | 11. launch the app in macos
87 | 
88 | ## Does it safe?
89 | 
90 | Yes, we only modify sinf to re-authorize the ipa, and the sandbox will prevent the app from accessing the sinf file (which contains the private information of the appleid), so the app cannot find out that it has been modified.
91 | 
92 | 


--------------------------------------------------------------------------------
/fairfree.js:
--------------------------------------------------------------------------------
  1 | 
  2 | const cm = new CModule(`
  3 | #include <stdio.h>
  4 | 
  5 | unsigned int calcDecryptDataLen(unsigned long X0)
  6 | {
  7 |     unsigned int v0 = (X0 ^ 0x2CFCF86E);
  8 |     unsigned int v1 = 1514590667 * v0;
  9 | 
 10 |     unsigned int v12 = *(unsigned int *)(X0+0x28) + v1;
 11 |     
 12 |     unsigned int v770 = v12 - 0x44A75F25;
 13 |     
 14 |     unsigned int v24 = (v770 - ((2 * v770 + 274998170) & 0x66F8C006) - 0x44518E30) ^ 0xB37C6003;
 15 | 
 16 |     return v24;
 17 | }
 18 | 
 19 | 
 20 | unsigned int calcEncryptDataLen(unsigned long a1)
 21 | {
 22 |     unsigned int v2 = 2101767179 * (a1 ^ 0x4A16AFDC);
 23 |     
 24 |     unsigned long v5 = (unsigned int)(*(unsigned int *)(a1 + 0x28) - v2);
 25 |     unsigned long v7 = v5 - 1275503213 - ((2 * (v5 - 1275503213) - 441333462) & 0xB165B874) + 1267450063;
 26 |     unsigned int v13 = (v7 ^ 0xE74FB145) + (2 * v7 & 0x7FFADAFE ^ 0x31609874) + 2065611771;
 27 |     unsigned int  size = v13 - 0x3B1C297A;
 28 |     return size;
 29 | }
 30 | 
 31 | 
 32 | typedef unsigned long uint64_t;
 33 | typedef unsigned int uint32_t;
 34 | typedef unsigned int bool;
 35 | 
 36 | void signEncryptArg(uint64_t pArg, int datalen)
 37 | {
 38 |     // int datalen = 0xD0;
 39 |     // uint64_t pArg = 0x16FA31798;
 40 | 
 41 |     uint64_t X13 = pArg;
 42 |     uint32_t W23 = 0x6B9A323B + datalen;
 43 | 
 44 |     uint32_t W13 = (X13 ^ 0x4A16AFDC) * 0x7D466C0B;
 45 |     uint32_t W11 = W13 + W23 + 0xED938B9D;
 46 | 
 47 |     printf("\n%p    %X   %X\n", X13, W13, W11); //DF239AEE 38515994
 48 | 
 49 |     *(uint32_t*)(pArg + 0x28) = W11;
 50 | 
 51 |   {
 52 |     bool flag=1; //10025DF3C   CMP W8, W9
 53 |     uint32_t __W13 = 5; //10025DF40   LDR  W13, [SP,#0x137C]
 54 | 
 55 |     uint32_t W9 = !flag;
 56 |     uint32_t W10 = flag;
 57 | 
 58 |     //uint32_t
 59 |         W9 = W9*0x6195 + __W13;
 60 | 
 61 |     uint32_t W22 = W10*0x6198 + W9;
 62 | 
 63 |     uint32_t W12 = W22 + 0xFFFF9E65;
 64 |         
 65 |     //uint32_t
 66 |         W9 = W12 ^ W13;
 67 | 
 68 |     printf("\n\n%X   %X   %X\n\n", W22, W12, W9);
 69 | 
 70 |     *(uint32_t*)(pArg + 0x2C) = W9;
 71 |   }
 72 | }
 73 | 
 74 | `);
 75 | 
 76 | // console.log(JSON.stringify(cm));
 77 | 
 78 | const calcDecryptDataLen = new NativeFunction(cm.calcDecryptDataLen, 'int', ["pointer"]);
 79 | const calcEncryptDataLen = new NativeFunction(cm.calcEncryptDataLen, 'int', ["pointer"]);
 80 | const signEncryptArg = new NativeFunction(cm.signEncryptArg, 'void', ["pointer","int"]);
 81 | 
 82 | 
 83 |     var base_addr = Module.findBaseAddress("fairplayd.H2");
 84 |     send("base_addr addr:" + base_addr);
 85 | 
 86 |     global.lastsinf = "";
 87 | 
 88 |     Interceptor.attach(base_addr.add(0x021F3E4), {
 89 |         onEnter: function(args) {
 90 | 
 91 |            let key = args[0].add(0x10).readPointer();
 92 |            let iv = args[0].add(0x30).readPointer();
 93 |            let priv = args[0].add(0x20).readPointer();
 94 |            let outbuf = args[0].add(0x8).readPointer();
 95 | 
 96 |            let len_enc = args[0].add(0x28).readUInt();
 97 | 
 98 |            let datalen = calcDecryptDataLen(args[0]);
 99 |            console.log("\ndecode***********", args[0], "len="+datalen.toString(16), "in="+priv, "out="+outbuf);
100 | 
101 |            send("\ncallstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
102 |            send("return address: " + this.returnAddress.sub(base_addr));
103 | 
104 |            console.log("\n----key:\n", hexdump(key,{offset: 0,length: 16,header:false,ansi:false}), 
105 |            "\n----iv:\n", hexdump(iv,{offset: 0,length: 16,header:false,ansi:false}),
106 |            "\n----data:\n", hexdump(priv,{offset: 0,length: datalen})
107 |            );
108 | 
109 |            this.datalen = datalen;
110 |            this.outbuf = outbuf;
111 |            this.key = key;
112 |            this.iv = iv;
113 |            
114 |            //if(datalen==0x1B0) {
115 |             // for(let i=0; i<16; i++) key.add(i).writeU8(0);
116 |             // for(let i=0; i<16; i++) iv.add(i).writeU8(0);
117 |             // for(let i=0; i<0x1B0; i++) priv.add(i).writeU8(0);
118 |            //}
119 | 
120 |        },
121 |        onLeave: function(retval){ 
122 |            //retval.replace(0);
123 | 
124 |            for(let i=0; i<this.datalen; i++)
125 |            {
126 |                 let p = this.outbuf.add(i);
127 |                 p.writeU8(p.readU8() ^ 0x45);
128 |            }
129 |             
130 |             console.log("\n----decrypted:\n", 
131 |                 hexdump(this.outbuf, {offset: 0, length: this.datalen})
132 |             );
133 | 
134 |             var savefile = "/tmp/"+this.outbuf+"."+this.datalen;
135 |             var file = new File(savefile, "wb");
136 |             file.write(this.outbuf.readByteArray(this.datalen));
137 |             file.flush()
138 |             file.close();
139 | 
140 |            for(let i=0; i<this.datalen; i++)
141 |            {
142 |                 let p = this.outbuf.add(i);
143 |                 p.writeU8(p.readU8() ^ 0x45);
144 |            }
145 | 
146 | 
147 |            if(this.datalen==0x1B0)
148 |            {
149 |             console.log("lastsinf="+global.lastsinf);
150 | 
151 |             let datalen=this.datalen;
152 | 
153 |             let inbuf = Memory.dup(this.outbuf, datalen);
154 | 
155 |             inbuf.add(0xA6).writeU8(0 ^ 0x45); //mode=0
156 | 
157 |             let outbuf = Memory.alloc(datalen);
158 | 
159 |             let arg = Memory.alloc(0x30);
160 |             arg.add(0x00).writePointer(this.key);
161 |             arg.add(0x10).writePointer(this.iv);
162 |             arg.add(0x18).writePointer(outbuf);
163 |             arg.add(0x20).writePointer(inbuf);
164 | 
165 |             signEncryptArg(arg, datalen);
166 | 
167 |             const funcEncrypt = new NativeFunction(base_addr.add(0x7790F8), 'void', ["pointer"]);
168 | 
169 |             funcEncrypt(arg);
170 | 
171 |             console.log("ret="+arg.add(8).readUInt().toString(16), "datalen="+datalen.toString(16), "\n", hexdump(outbuf,{offset: 0,length: datalen}) );
172 | 
173 |             let fopen = new NativeFunction(Module.findExportByName(null,"fopen"), 'pointer', ["pointer", "pointer"]);
174 |             let fwrite = new NativeFunction(Module.findExportByName(null,"fwrite"), 'int', ["pointer", "int", "int", "pointer"]);
175 |             let fclose = new NativeFunction(Module.findExportByName(null,"fclose"), 'void', ["pointer"]);
176 |             let fseek = new NativeFunction(Module.findExportByName(null,"fseek"), 'void', ["pointer", "int", "int"]);
177 | 
178 |             const SEEK_SET=0;
179 |             let fp = fopen(Memory.allocUtf8String(global.lastsinf),  Memory.allocUtf8String("rb+"));
180 |             console.log("fp=", fp);
181 | 
182 |             fseek(fp, 0xC6, SEEK_SET);
183 |             let mode = Memory.alloc(1); mode.writeU8(0);
184 |             fwrite(mode, 1, 1, fp);
185 | 
186 |             fseek(fp, 0x1E0, SEEK_SET); //priv
187 |             fwrite(outbuf, datalen, 1, fp);
188 | 
189 |             fclose(fp);
190 |            }
191 |        }
192 |    });
193 | 
194 | 
195 | 
196 | let data = [ 
197 |     0x69, 0x74, 0x75, 0x6e, 0x00, 0x00, 0x00, 0x0c, 0x76, 0x65, 0x72, 0x73, 0x00, 0x00, 0x00, 0x01,  
198 |     0x00, 0x00, 0x00, 0x18, 0x6b, 0x65, 0x79, 0x20, 0x17, 0x5b, 0xc7, 0x3d, 0x91, 0xaf, 0x0e, 0x52,  
199 |     0x64, 0xe1, 0xa7, 0xea, 0x64, 0x28, 0x7c, 0x07, 0x00, 0x00, 0x00, 0x18, 0x69, 0x76, 0x69, 0x76,  
200 |     0x4e, 0xac, 0xfd, 0xaa, 0xb1, 0x87, 0xf6, 0x84, 0x0f, 0x37, 0x25, 0x8e, 0xc7, 0x42, 0xab, 0xfc,  
201 |     0x00, 0x00, 0x00, 0x18, 0x74, 0x6d, 0x70, 0x72, 0xb3, 0xc6, 0xb9, 0xf9, 0x73, 0x06, 0x9b, 0xbf,  
202 |     0xdb, 0xf6, 0x67, 0x84, 0x5a, 0x50, 0x86, 0x8e, 0x00, 0x00, 0x00, 0x58, 0x72, 0x69, 0x67, 0x68,  
203 |     0x76, 0x65, 0x49, 0x44, 0x00, 0x21, 0x4d, 0xae, 0x70, 0x6c, 0x61, 0x74, 0x00, 0x00, 0x00, 0x02,  
204 |     0x61, 0x76, 0x65, 0x72, 0x01, 0x01, 0x01, 0x00, 0x74, 0x72, 0x61, 0x6e, 0xdf, 0x4a, 0x6c, 0x1f,  
205 |     0x73, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x73, 0x6f, 0x6e, 0x67, 0x27, 0xd8, 0x83, 0x43,  
206 |     0x74, 0x6f, 0x6f, 0x6c, 0x50, 0x36, 0x30, 0x35, 0x6d, 0x65, 0x64, 0x69, 0x00, 0x00, 0x00, 0x80,  
207 |     0x6d, 0x6f, 0x64, 0x65, 0x00, 0x00, 0x20, 0x00, 0x68, 0x69, 0x33, 0x32, 0x00, 0x00, 0x00, 0x04,  
208 |     0x00, 0x00, 0x01, 0x08, 0x6e, 0x61, 0x6d, 0x65, 0xe7, 0x9b, 0x9b, 0x20, 0xe5, 0xbc, 0xa0, 0x00,  
209 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
210 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
211 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
212 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
213 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
214 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
215 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
216 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
217 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
218 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
219 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
220 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
221 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
222 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
223 |     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,   
224 |     ];
225 | 
226 | //let data = [0x69,0x74,0x75,0x6e,0x00,0x00,0x00,0x0c,0x76,0x65,0x72,0x73,0x00,0x00,0x00,0x01];
227 | let datalen=data.length;
228 | 
229 | let iv = Memory.alloc(0x10);
230 | let key = Memory.alloc(0x10);
231 | let inbuf = Memory.alloc(datalen);
232 | let outbuf = Memory.alloc(datalen);
233 | 
234 | for(let i=0; i<16; i++) key.add(i).writeU8([0xD7,0x8D,0x1A,0xB7,0x9B,0xD1,0x50,0xD2,0x45,0x60,0xE2,0x33,0xA8,0x71,0xBB,0xA2][i]);
235 | 
236 | for(let i=0; i<16; i++) iv.add(i).writeU8([0x04,0xAA,0x10,0xE4,0x13,0xE9,0x94,0x2E,0xC0,0x7D,0x28,0x5C,0xBE,0xCD,0xA4,0x15][i]);
237 | 
238 | for(let i=0; i<datalen; i++) inbuf.add(i).writeU8(data[i] ^ 0x45);
239 | 
240 | let arg = Memory.alloc(0x30);
241 | arg.add(0x00).writePointer(key);
242 | arg.add(0x10).writePointer(iv);
243 | arg.add(0x18).writePointer(outbuf);
244 | arg.add(0x20).writePointer(inbuf);
245 | 
246 | signEncryptArg(arg, datalen);
247 | 
248 | const funcEncrypt = new NativeFunction(base_addr.add(0x7790F8), 'void', ["pointer"]);
249 | 
250 | funcEncrypt(arg);
251 | 
252 | console.log("ret="+arg.add(8).readUInt().toString(16), "datalen="+datalen.toString(16), "\n", hexdump(outbuf,{offset: 0,length: datalen}) );
253 | 
254 | if(0)
255 |    Interceptor.attach(base_addr.add(0x7790F8), {
256 |        onEnter: function(args) {
257 |             let key = args[0].add(0).readPointer();
258 |             let iv = args[0].add(0x10).readPointer();
259 |             let outbuf = args[0].add(0x18).readPointer();
260 |             let inbuf = args[0].add(0x20).readPointer();
261 | 
262 |             //signEncryptArg(args[0], 16);
263 | 
264 |             let datalen = calcEncryptDataLen(args[0]);
265 |             console.log("\x07*********** encode ***********", args[0], "len="+datalen.toString(16), "in="+inbuf, "out="+outbuf);
266 | 
267 |             //send("\ncallstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
268 |             send("return address: " + this.returnAddress.sub(base_addr));
269 | 
270 |             //!auto dealloc by frida!
271 |             //Memory.protect(iv, 16, "rw-");
272 |             
273 |             iv=this.iv=Memory.dup(iv, 16); args[0].add(0x10).writePointer(this.iv);
274 |             key=this.key=Memory.dup(key, 16); args[0].add(0).writePointer(this.key);
275 |             //inbuf=this.inbuf=Memory.dup(inbuf, datalen); args[0].add(0x20).writePointer(this.inbuf);
276 | 
277 |             //make sure inbuf < outbuf
278 |             this.newbuf = Memory.alloc(datalen*2);
279 |             Memory.copy(this.newbuf, inbuf, datalen);
280 |             inbuf = this.newbuf;  args[0].add(0x20).writePointer(inbuf);
281 |             outbuf = this.newbuf.add(datalen); args[0].add(0x18).writePointer(outbuf);
282 | 
283 |             // for(let i=0; i<16; i++) key.add(i).writeU8(0);
284 |             // for(let i=0; i<16; i++) iv.add(i).writeU8(0);
285 |             // for(let i=0; i<16; i++) inbuf.add(i).writeU8([0x02,0x01,0x3A,0xB2,0xFC,0x21,0x68,0xCD,0x43,0x7D,0x27,0xB0,0x10,0x42,0x9B,0xD4][i]);
286 |             
287 |             for(let i=0; i<16; i++) key.add(i).writeU8([0xD7,0x8D,0x1A,0xB7,0x9B,0xD1,0x50,0xD2,0x45,0x60,0xE2,0x33,0xA8,0x71,0xBB,0xA2][i]);
288 | 
289 |             for(let i=0; i<16; i++) iv.add(i).writeU8([0x04,0xAA,0x10,0xE4,0x13,0xE9,0x94,0x2E,0xC0,0x7D,0x28,0x5C,0xBE,0xCD,0xA4,0x15][i]);
290 | 
291 |             for(let i=0; i<16; i++) inbuf.add(i).writeU8([0x69,0x74,0x75,0x6e,0x00,0x00,0x00,0x0c,0x76,0x65,0x72,0x73,0x00,0x00,0x00,0x01][i] ^ 0x45);
292 | 
293 | 
294 |             //args[0].add(0x28).writeInt(datalen + 0x3B1C297A);
295 |  
296 |             console.log("\n----key:\n", hexdump(key,{offset: 0,length: 16,header:false,ansi:false}), 
297 |             "\n----iv:\n", hexdump(iv,{offset: 0,length: 16,header:false,ansi:false}),
298 |             "\n----data:\n", hexdump(inbuf,{offset: 0,length: datalen})
299 |             );
300 | 
301 |             this.datalen = datalen;
302 |             this.outbuf = outbuf;
303 |        },
304 |        onLeave: function(retval){ 
305 |            //retval.replace(0);
306 |             
307 |             console.log("\n-------------encrypted:\n", 
308 |                 hexdump(this.outbuf, {offset: 0, length: this.datalen})
309 |             );
310 |        }
311 |     });
312 | 
313 | 
314 | global.fds = [];
315 | 
316 | Interceptor.attach(Module.findExportByName("libSystem.B.dylib","open"), {
317 |     onEnter: function(args) {
318 |        //send("hookfunc: "+args[0] + " " +args[1] + " " +args[2] + " " +args[3] + " " +args[4] + " " +args[5] + " " +args[6] + " " +args[7] + " ");
319 |        send("\n******** open "+args[1]+"\t"+args[0].readCString());
320 |         this.fname = args[0].readCString();
321 |        send("callstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
322 |        send("return address: " + this.returnAddress.sub(base_addr));
323 | 
324 |        if(/\.sinf$/.test(this.fname)) global.lastsinf = this.fname;
325 |    },
326 |    onLeave: function(retval){ 
327 |        send("func return: "+retval+"\n");
328 |        global.fds[retval] = this.fname;
329 |        //send(hexdump(retval, {offset: 0,length: 64,header: true,ansi: true}));
330 |        //retval.replace(0); 
331 |    }
332 | });
333 | 
334 | Interceptor.attach(Module.findExportByName("libSystem.B.dylib","open_dprotected_np"), {
335 |     onEnter: function(args) {
336 |        //send("hookfunc: "+args[0] + " " +args[1] + " " +args[2] + " " +args[3] + " " +args[4] + " " +args[5] + " " +args[6] + " " +args[7] + " ");
337 |        send("\n******** open_dprotected_np "+args[1]+"\t"+args[0].readCString());
338 |         this.fname = args[0].readCString();
339 |        send("callstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
340 |        send("return address: " + this.returnAddress.sub(base_addr));
341 |    },
342 |    onLeave: function(retval){ 
343 |        send("func return: "+retval+"\n");
344 |        global.fds[retval] = this.fname;
345 |        //send(hexdump(retval, {offset: 0,length: 64,header: true,ansi: true}));
346 |        //retval.replace(0); 
347 |    }
348 | });
349 | 
350 | 
351 | const lseek = new NativeFunction(Module.findExportByName("libSystem.B.dylib","lseek"), 'int', ["int", "int", "int"]);
352 | 
353 | Interceptor.attach(Module.findExportByName("libSystem.B.dylib","write"), {
354 |     onEnter: function(args) {
355 |         const SEEK_CUR=1;
356 |         let off = lseek(Number(args[0]),  0, SEEK_CUR);
357 |        console.log("\x07\n******** write "+args[0], args[1], args[2], "off="+off, "name="+global.fds[args[0]], "\n");
358 | 
359 |        send("callstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
360 |        send("return address: " + this.returnAddress.sub(base_addr));
361 | 
362 |        console.log("\n", args[1].readByteArray(Number(args[2])));
363 | 
364 |     //    if(Number(args[2])==0xE4) {
365 |     //         args[1].writeInt(0);
366 |     //    }
367 |    }
368 | });
369 | 
370 | // Interceptor.attach(Module.findExportByName("fairplayd.H2", "malloc"), {
371 | //     onEnter: function(args) {
372 | //        //send("hookfunc: "+args[0] + " " +args[1] + " " +args[2] + " " +args[3] + " " +args[4] + " " +args[5] + " " +args[6] + " " +args[7] + " ");
373 | //        console.log("malloc", args[0], Number(args[0]));
374 | 
375 | //        this.allocsize = Number(args[0]);
376 | 
377 | //        send("callstack:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
378 | //        send("return address: " + this.returnAddress.sub(base_addr));
379 | //    },
380 | //    onLeave: function(retval) { 
381 | //         for(let i=0; i<this.allocsize; i++) retval.add(i).writeU8(0);
382 | //        send("buffer= "+retval+" ~" + retval.add(this.allocsize) + "\n\n");
383 | //        //global.malloc[retval] = this.allocsize;
384 | //        //send(hexdump(retval, {offset: 0,length: 64,header: true,ansi: true}));
385 | //        //retval.replace(0); 
386 | //    }
387 | // });


--------------------------------------------------------------------------------